Privacy Policy

Last updated: 13 July 2026

1. Who we are

Law Apprenticeships (https://lawapprenticeships.co.uk) is operated by Data Law Limited, trading as Datalaw, a company registered in England and Wales (company number 03502562), whose registered office is at Hubsquared, Baltic Triangle, Bridgewater Street, Liverpool L1 0AR. Data Law Limited is the data controller for the personal information described in this notice and is registered with the Information Commissioner's Office (registration Z1587220). Our Data Protection Officer is Henry Dean: dpo@datalaw.org, 0151 236 2024.

This notice is governed by the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003.

2. Summary

Law Apprenticeships matches candidates with law firms offering apprenticeships. To do that, we collect the information you put into your profile (including your CV and, where you record one, a video introduction), we use AI services to read CVs, and automated systems check, score and rank candidates against firms' requirements. Candidates join the platform to be matched: our systems score your profile against roles and our recruitment team reviews shortlists before they reach a firm. Some firms also list roles publicly on the job board. If you apply to one directly, an automated check routes your application: matches and close matches go to our recruiter, but applications a long way from the firm's stated requirements are stopped automatically. We tell you which requirements you did not meet, and you can correct your profile and apply again, or ask a person to review the decision. Section 5 explains all of this.

3. What we collect

Candidates

• Account data: name, email address, password, or your Google sign-in identity;
• Profile data: photo or avatar, desired apprenticeship programmes, eligibility answers, work history, skills;
• Your CV, and the information our systems extract from it (qualifications, experience, employers, dates);
• Video introductions, where you choose to record one (these capture your image and voice);
• Your postcode, which we convert to an approximate location so we can measure how far you are from an employer's office. We do not use your exact address for anything else;
• Assessment answers and your scored results;
• References: your referees' names, work email addresses, job titles, relationship to you, and the answers they give us.

Law firms

• Organisation details, SRA number, contact details, billing information (payments are processed by Stripe; we do not store card numbers). We also collect publicly available firm information from the SRA register and review platforms; this concerns firms, not candidates.

Collected automatically

• IP address, device and browser information, cookies and similar technologies (see our Cookie Policy), analytics events, bot-protection signals, and error and diagnostic logs (which can incidentally include personal data).

Information we do not ask for

We do not ask for special category data (such as health or ethnicity information). CVs sometimes contain it anyway. Please avoid including information of that kind in your CV. It plays no part in matching or scoring, and where we notice it we do not use it. We do not ask for criminal records information.

4. How and why we use your information

What we use	Purpose	Lawful basis
Account data	Creating and securing your account; signing you in	Contract
CV and extracted profile data	Building your candidate profile; matching and applications	Contract
Photo/avatar	Identifying you on your profile to firms	Consent
Video introduction	Allowing firms you apply to (or are matched with) to view your introduction	Consent
Postcode and coordinates	Matching you with firms within travelling distance	Legitimate interests
Programme choices, eligibility answers, work history, skills	Matching and eligibility checks	Contract
Assessment answers and scores	Screening against firm requirements	Contract
Referee details and reference answers	Collecting references for your applications	Legitimate interests
Firm and billing data	Operating employer accounts and billing	Contract
IP, device and security signals	Keeping the platform secure; preventing bots and abuse	Legitimate interests
Analytics	Understanding how the site is used	Consent
Error and diagnostic logs	Fixing faults and keeping the service reliable	Legitimate interests

5. Automated decision-making and AI

We use automated processing, including AI, to run the matching service. This section explains what those systems do, what they mean for you, and your rights over them. The platform is first and foremost a matching service (5.1). One process — the requirements check on direct applications to publicly listed roles (5.2) — makes a decision about you by solely automated means; the others sort, score and assist, with people making the decisions.

5.1 Matching and shortlisting — how the service mainly works

For matching, we score your profile against open roles using the same kinds of criteria: the apprenticeship you want, your location and travel radius, your qualifications, your experience and your assessment results. Your preferences act as filters that you control: if you tell us you want to work in one city, roles elsewhere will not be matched to you. You can widen or change your preferred programmes and locations at any time. The score shapes who appears on the shortlist for a role, and a member of our recruitment team reviews shortlists before they go to an employer, as a traditional recruiter would. Firms then make their own decisions about invitations, interviews and hiring. If you believe your profile is being scored on wrong or out-of-date information, correct it in your profile.

5.2 Direct applications to the job board: the automated requirements check

When you apply to a role a firm has listed publicly, our system checks your profile against that firm's stated requirements: the apprenticeship the role is for, the entry requirements, any minimum experience, and any assessment scores the firm has set. What happens next depends on how closely you match. Applications that meet the requirements go to our recruitment team. Applications that come close appear to our recruiter in a close-matches list, and the recruiter — a person — decides whether to keep you in the running. Applications a long way from the requirements are not put in front of our recruiter at all: that outcome is decided solely by the automated check, and it has a significant effect, because your application is not considered further for that role.

Where the automated check stops your application, we tell you which requirements you did not meet. Your rights: you can ask for a person to review the decision, contest it, and give us your own account of the situation. Contact Justine.Stevens@datalaw.org and we will arrange it. If information on your profile was wrong or out of date, you can correct it at any time and apply again, or ask us to run the check again.

5.3 Eligibility and assessments

We work out which apprenticeship routes you are eligible for from the answers and qualifications on your profile; this is done automatically. Where a role includes an aptitude or skills assessment, it is marked automatically against a pass mark the firm has set, and your result can affect whether you go forward. If you believe a result is wrong, you can ask for human review.

5.4 AI reading of CVs and AI-drafted content

When you upload a CV, we use Mistral AI (based in the EU) to read it and pull out structured details such as your qualifications and work history, and to draft prompts for your video introduction. AI can get things wrong, and it has to guess at things your CV does not spell out. That is why we ask you to check and correct everything it produces, and nothing the AI drafts is used until you confirm it. We also use OpenAI (based in the US) for the assistant feature inside employer accounts. No AI provider uses your data to train its models under our contracts.

5.5 What the automation never does

No automated process uses special category data. No hiring decision is made by the platform: firms decide who to interview and hire. The only automated decline is the requirements check on direct applications in 5.2, and a human review of it is always available on request.

6. Who we share your information with

We share personal information with the following service providers under written contracts containing UK GDPR Article 28 terms, and with firms as described:

• Firms you apply to (or are matched with) — your profile, CV data, video introduction, assessment results and references, so they can consider you;
• Mistral AI (EU) — CV reading and extraction, AI script drafting;
• OpenAI (US) — the assistant feature inside employer accounts;
• Google — sign-in (OAuth), and Google Analytics and Tag Manager (US) where you consent to analytics cookies;
• DigitalOcean — storage of CVs, photos and video introductions;
• Stripe (US) — firm payments;
• Cloudflare — bot protection (Turnstile);
• postcodes.io — converting postcodes to coordinates;
• Resend and IONOS — transactional email;
• Zapier (US) — routing new application details into our own systems;
• Sentry — error monitoring;
• Vercel — hosting, web analytics and performance monitoring.

We do not sell personal information. Firm-side data sources (the SRA register, review platforms) concern firms rather than candidates.

7. International transfers

Where a provider processes personal information outside the UK — primarily in the United States (OpenAI, Google, Stripe, Zapier, and US infrastructure of other providers) — we rely on safeguards under Articles 44-46 UK GDPR: the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified. You can request details of the safeguard for any particular transfer from our DPO.

8. How long we keep your information

• Candidate accounts and profiles: for as long as your account is active, and deleted 12 months after your last activity (we will email you before deleting);
• CVs and video introductions: while your account is active; replaced versions are deleted when you replace them;
• Unsuccessful or declined applications: 12 months from the decision, so we can handle review requests, then deleted;
• References: 12 months from collection;
• Firm account and billing records: 6 years (Companies Act and tax rules);
• Security, analytics and diagnostic logs: up to 12 months.

You can delete your account at any time, which removes your profile, CV and videos, subject to short backup cycles and anything we must keep by law.

9. Security

We use encryption in transit, access controls, bot protection and monitored infrastructure. No system is perfectly secure, but we design for minimal data exposure and respond quickly to incidents. Where a breach is likely to put you at risk, we will notify the ICO within 72 hours and, where the risk is high, tell you directly.

10. Under-18s

Apprenticeship candidates can be under 18. We apply the standards of the ICO's Age Appropriate Design Code to the platform, collect only what the matching service needs, and do not use under-18s' data for any advertising. Video introductions are optional for everyone and we encourage under-18 candidates to discuss their profile with a parent, guardian or careers adviser. The human-review rights in Section 5 apply with particular care where the candidate is under 18.

11. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the rights relating to automated decisions in Section 5. Since 19 June 2026 you also have the right under section 164A of the Data Protection Act 2018 to complain directly to us: use our data protection complaints form or email dpo@datalaw.org, and we will acknowledge your complaint within 30 days. You can complain to the Information Commissioner's Office at any time (ico.org.uk, 0303 123 1113). To exercise any right, email dpo@datalaw.org; we respond within one month.

12. Cookies

We use cookies and similar technologies for security, sign-in, analytics and performance. Details, durations and how to accept or refuse them are in our Cookie Policy. Non-essential cookies are not set without your consent.

13. Changes and contact

We will update this notice as the platform, our providers or the law change; the date at the top shows the current version, and material changes will be flagged on the site. Contact: Data Protection Officer, Data Law Limited, 3A Bridgewater Street, Liverpool L1 0AR — dpo@datalaw.org — 0151 236 2024.